General Impossibility of Group HomomorphicEncryption in the Quantum World

Frederik Armknecht Tommaso GagliardoniStefan Katzenbeisser Andreas Peter

PKC 2014, March 28thBuenos Aires, Argentina

1

An example

Consider the basic, unpadded RSA:

• let N = pq for large primes p and q, consider group (Z∗n, ·)

• public exponent e s.t. gcd(e, φ(N)) = 1

• secret exponent d = e−1 mod φ(N)

• Enc(m) = me mod N for plaintext m

• Dec(c) = cd mod N for ciphertext c .

Now consider two plaintexts m1,m2, and consider the product oftheir encryptions:

• c1 = Enc(m1), c2 = Enc(m2)

• Dec(c1 · c2) = Dec(me1·me

2) = Dec((m1 ·m2)

e) =(m1 ·m2)

ed mod N = m1 ·m2.

In this case, decryption is a group homomorphism.

2

An example

Consider the basic, unpadded RSA:

• let N = pq for large primes p and q, consider group (Z∗n, ·)

• public exponent e s.t. gcd(e, φ(N)) = 1

• secret exponent d = e−1 mod φ(N)

• Enc(m) = me mod N for plaintext m

• Dec(c) = cd mod N for ciphertext c .

Now consider two plaintexts m1,m2, and consider the product oftheir encryptions:

• c1 = Enc(m1), c2 = Enc(m2)

• Dec(c1 · c2) = Dec(me1·me

2) = Dec((m1 ·m2)

e) =(m1 ·m2)

ed mod N = m1 ·m2.

In this case, decryption is a group homomorphism.

2

An example

Consider the basic, unpadded RSA:

• let N = pq for large primes p and q, consider group (Z∗n, ·)

• public exponent e s.t. gcd(e, φ(N)) = 1

• secret exponent d = e−1 mod φ(N)

• Enc(m) = me mod N for plaintext m

• Dec(c) = cd mod N for ciphertext c .

Now consider two plaintexts m1,m2, and consider the product oftheir encryptions:

• c1 = Enc(m1), c2 = Enc(m2)

• Dec(c1 · c2) = Dec(me1·me

2) = Dec((m1 ·m2)

e) =(m1 ·m2)

ed mod N = m1 ·m2.

In this case, decryption is a group homomorphism.

2

Group Homomorphic Encryption (GHE)

A public-key encryption scheme E = (KeyGen,Enc,Dec) is calledgroup homomorphic if, for any (pk , sk)← Keygen(λ):

• the plaintext space P is a group in respect to ⊗• the set of encryptions C :=

{Encpk(m; r)|m ∈ P, r ∈ Rnd

}is

a group in respect to ?

• the decryption is a group homomorphism:Decsk(c1 ? c2) = Decsk(c1)⊗ Decsk(c2), for every c1, c2 ∈ C.

(from now on we will only consider Abelian groups)

3

Group Homomorphic Encryption (GHE)

A public-key encryption scheme E = (KeyGen,Enc,Dec) is calledgroup homomorphic if, for any (pk , sk)← Keygen(λ):

• the plaintext space P is a group in respect to ⊗

• the set of encryptions C :={Encpk(m; r)|m ∈ P, r ∈ Rnd

}is

a group in respect to ?

• the decryption is a group homomorphism:Decsk(c1 ? c2) = Decsk(c1)⊗ Decsk(c2), for every c1, c2 ∈ C.

(from now on we will only consider Abelian groups)

3

Group Homomorphic Encryption (GHE)

A public-key encryption scheme E = (KeyGen,Enc,Dec) is calledgroup homomorphic if, for any (pk , sk)← Keygen(λ):

• the plaintext space P is a group in respect to ⊗• the set of encryptions C :=

{Encpk(m; r)|m ∈ P, r ∈ Rnd

}is

a group in respect to ?

• the decryption is a group homomorphism:Decsk(c1 ? c2) = Decsk(c1)⊗ Decsk(c2), for every c1, c2 ∈ C.

(from now on we will only consider Abelian groups)

3

Group Homomorphic Encryption (GHE)

A public-key encryption scheme E = (KeyGen,Enc,Dec) is calledgroup homomorphic if, for any (pk , sk)← Keygen(λ):

• the plaintext space P is a group in respect to ⊗• the set of encryptions C :=

{Encpk(m; r)|m ∈ P, r ∈ Rnd

}is

a group in respect to ?

• the decryption is a group homomorphism:Decsk(c1 ? c2) = Decsk(c1)⊗ Decsk(c2), for every c1, c2 ∈ C.

(from now on we will only consider Abelian groups)

3

Group Homomorphic Encryption (GHE)

A public-key encryption scheme E = (KeyGen,Enc,Dec) is calledgroup homomorphic if, for any (pk , sk)← Keygen(λ):

• the plaintext space P is a group in respect to ⊗• the set of encryptions C :=

{Encpk(m; r)|m ∈ P, r ∈ Rnd

}is

a group in respect to ?

• the decryption is a group homomorphism:Decsk(c1 ? c2) = Decsk(c1)⊗ Decsk(c2), for every c1, c2 ∈ C.

(from now on we will only consider Abelian groups)

3

Fully Homomorphic Encryption (FHE)

In Fully Homomorphic Encryption we have the following properties:

• plaintext and ciphertext spaces are rings, not just groups (sothere are two operations)

• the set of encryptions C is usually just a set, not necessarily agroup

• the decryption is guaranteed to run correctly only after lessthan p(λ) evaluations for some polynomial p.

(even if p can be adjusted dynamically through bootstrapping, inGHE the decryption is guaranteed even after unbounded manyevaluations)

4

The di�erences

GHE is not `FHE with just one operation': it is something di�erent.

5

The di�erences

GHE is not `FHE with just one operation': it is something di�erent.

5

The di�erences

GHE is not `FHE with just one operation': it is something di�erent.

5

The di�erences

GHE is not `FHE with just one operation': it is something di�erent.

5

The di�erences

GHE is not `FHE with just one operation': it is something di�erent.

5

Examples of GHE schemes

RSAElGamalGoldwasser-MicaliPailler...

brokenbrokenbrokenbroken

Shor's algorithm

Factorization of integers in quantum PPT.

Watrous' and other variants

Discrete logarithm and many related computational problems inquantum PPT.

Question

Is GHE possible at all in the quantum world?

6

Examples of GHE schemes

RSAElGamalGoldwasser-MicaliPailler...

brokenbrokenbrokenbroken

Shor's algorithm

Factorization of integers in quantum PPT.

Watrous' and other variants

Discrete logarithm and many related computational problems inquantum PPT.

Question

Is GHE possible at all in the quantum world?

6

Examples of GHE schemes

RSAElGamalGoldwasser-MicaliPailler...

broken

brokenbrokenbroken

Shor's algorithm

Factorization of integers in quantum PPT.

Watrous' and other variants

Discrete logarithm and many related computational problems inquantum PPT.

Question

Is GHE possible at all in the quantum world?

6

Examples of GHE schemes

RSAElGamalGoldwasser-MicaliPailler...

broken

brokenbrokenbroken

Shor's algorithm

Factorization of integers in quantum PPT.

Watrous' and other variants

Discrete logarithm and many related computational problems inquantum PPT.

Question

Is GHE possible at all in the quantum world?

6

Examples of GHE schemes

RSAElGamalGoldwasser-MicaliPailler...

brokenbrokenbrokenbroken

Shor's algorithm

Factorization of integers in quantum PPT.

Watrous' and other variants

Discrete logarithm and many related computational problems inquantum PPT.

Question

Is GHE possible at all in the quantum world?

6

Examples of GHE schemes

RSAElGamalGoldwasser-MicaliPailler...

brokenbrokenbrokenbroken

Shor's algorithm

Factorization of integers in quantum PPT.

Watrous' and other variants

Discrete logarithm and many related computational problems inquantum PPT.

Question

Is GHE possible at all in the quantum world?6

Our result

Theorem

Let E be any IND-CPA secure GHE scheme. Then there exists aPPT quantum algorithm which breaks the security of E withnon-negligible probability.

7

IND-CPA Security

8

IND-CPA Security

8

Subgroup Membership Problem (SMP)

Consider a group G and a non-trivial subgroup H < G .

Given an element x ∈ G drawn from some distribution:

Problem: decide whether x ∈ H or x ∈ G \ H.

Remark

In a GHE scheme, the set of encryptions of the neutral element1G ,

{Encpk(1G ; r)|r ∈ Rnd

}is a subgroup of the ciphertext group.

Theorem

For GHE schemes, IND-CPA security implies hardness of SMPrespect to the subgroup of encryptions of 1G .

notice: vice versa does not hold.

9

Subgroup Membership Problem (SMP)

Consider a group G and a non-trivial subgroup H < G .

Given an element x ∈ G drawn from some distribution:

Problem: decide whether x ∈ H or x ∈ G \ H.

Remark

In a GHE scheme, the set of encryptions of the neutral element1G ,

{Encpk(1G ; r)|r ∈ Rnd

}is a subgroup of the ciphertext group.

Theorem

For GHE schemes, IND-CPA security implies hardness of SMPrespect to the subgroup of encryptions of 1G .

notice: vice versa does not hold.

9

Subgroup Membership Problem (SMP)

Consider a group G and a non-trivial subgroup H < G .

Given an element x ∈ G drawn from some distribution:

Problem: decide whether x ∈ H or x ∈ G \ H.

Remark

In a GHE scheme, the set of encryptions of the neutral element1G ,

{Encpk(1G ; r)|r ∈ Rnd

}is a subgroup of the ciphertext group.

Theorem

For GHE schemes, IND-CPA security implies hardness of SMPrespect to the subgroup of encryptions of 1G .

notice: vice versa does not hold.

9

Subgroup Membership Problem (SMP)

Consider a group G and a non-trivial subgroup H < G .

Given an element x ∈ G drawn from some distribution:

Problem: decide whether x ∈ H or x ∈ G \ H.

Remark

In a GHE scheme, the set of encryptions of the neutral element1G ,

{Encpk(1G ; r)|r ∈ Rnd

}is a subgroup of the ciphertext group.

Theorem

For GHE schemes, IND-CPA security implies hardness of SMPrespect to the subgroup of encryptions of 1G .

notice: vice versa does not hold.9

An attack based on Order Finding

Order Finding Problem (OFP): given a non-trivial subgroupH < G , �nd the order (cardinality) of H.

There is a simple way of reducing SMP to OFP. Given G ,H, x ∈ G :

1 compute order of H2 compute order of 〈H, x〉 (subgroup generated by H and x)3 x ∈ H i� the two orders are the same.

Watrous' order-�nding quantum algorithm

Given generators g1, . . . , gk of subgroup H < G , there exists a PPTquantum algorithm which outputs o(H).

Done!

10

An attack based on Order Finding

Order Finding Problem (OFP): given a non-trivial subgroupH < G , �nd the order (cardinality) of H.

There is a simple way of reducing SMP to OFP. Given G ,H, x ∈ G :

1 compute order of H2 compute order of 〈H, x〉 (subgroup generated by H and x)3 x ∈ H i� the two orders are the same.

Watrous' order-�nding quantum algorithm

Given generators g1, . . . , gk of subgroup H < G , there exists a PPTquantum algorithm which outputs o(H).

Done!

10

An attack based on Order Finding

Order Finding Problem (OFP): given a non-trivial subgroupH < G , �nd the order (cardinality) of H.

There is a simple way of reducing SMP to OFP. Given G ,H, x ∈ G :

1 compute order of H2 compute order of 〈H, x〉 (subgroup generated by H and x)3 x ∈ H i� the two orders are the same.

Watrous' order-�nding quantum algorithm

Given generators g1, . . . , gk of subgroup H < G , there exists a PPTquantum algorithm which outputs o(H).

Done!

10

An attack based on Order Finding

Order Finding Problem (OFP): given a non-trivial subgroupH < G , �nd the order (cardinality) of H.

There is a simple way of reducing SMP to OFP. Given G ,H, x ∈ G :

1 compute order of H2 compute order of 〈H, x〉 (subgroup generated by H and x)3 x ∈ H i� the two orders are the same.

Watrous' order-�nding quantum algorithm

Given generators g1, . . . , gk of subgroup H < G , there exists a PPTquantum algorithm which outputs o(H).

Done!10

End of this talk

Thanks for your attention!

tommaso@gagliardoni.net

11

Not so fast...

What do we mean by a description of a group H?

• a black-box sampling algorithm to sample elements in H

• an explicit description of the neutral element• black-box access to the group operation• black-box access to the inversion of group elements

Notice: in GHE, we do not necessary have a set of generators.

12

Not so fast...

What do we mean by a description of a group H?

• a black-box sampling algorithm to sample elements in H

• an explicit description of the neutral element

• black-box access to the group operation

• black-box access to the inversion of group elements

Notice: in GHE, we do not necessary have a set of generators.

12

Not so fast...

What do we mean by a description of a group H?

• a black-box sampling algorithm to sample elements in H

• an explicit description of the neutral element

• black-box access to the group operation

• black-box access to the inversion of group elements

Notice: in GHE, we do not necessary have a set of generators.

12

Not so fast...

What do we mean by a description of a group H?

• a black-box sampling algorithm to sample elements in H

• an explicit description of the neutral element

• black-box access to the group operation

• black-box access to the inversion of group elements

Notice: in GHE, we do not necessary have a set of generators.

12

Not so fast...

What do we mean by a description of a group H?

• a black-box sampling algorithm to sample elements in H

• an explicit description of the neutral element

• black-box access to the group operation

• black-box access to the inversion of group elements

Notice: in GHE, we do not necessary have a set of generators.

12

Not so fast...

What do we mean by a description of a group H?

• a black-box sampling algorithm to sample elements in H

• an explicit description of the neutral element

• black-box access to the group operation

• black-box access to the inversion of group elements

Notice: in GHE, we do not necessary have a set of generators.

12

Not so fast...

What do we mean by a description of a group H?

• a black-box sampling algorithm to sample elements in H

• an explicit description of the neutral element

• black-box access to the group operation

• black-box access to the inversion of group elements

Notice: in GHE, we do not necessary have a set of generators.

12

The problem

Recall: we want to solve the SMP in G in respect to the subgroupof the encryption of 1G ; this would break IND-CPA security.

Idea: use the sampling algorithm by requesting encryptions of theneutral element, and hope to �nd a set of generators after not toomany samples.

13

The problem

Recall: we want to solve the SMP in G in respect to the subgroupof the encryption of 1G ; this would break IND-CPA security.

Idea: use the sampling algorithm by requesting encryptions of theneutral element, and hope to �nd a set of generators after not toomany samples.

13

The problem

Recall: we want to solve the SMP in G in respect to the subgroupof the encryption of 1G ; this would break IND-CPA security.

Idea: use the sampling algorithm by requesting encryptions of theneutral element, and hope to �nd a set of generators after not toomany samples.

13

The uniform case

If the Enc algorithm samples form H according to the uniformdistribution, where ord(H) ≤ 2k , then:

Theorem [Pak,Bratus,'99]

Sampling k + 4 elements yields a generating set for H withprobability ≥ 3

4.

But in general we can have arbitrary distributions!

14

The uniform case

If the Enc algorithm samples form H according to the uniformdistribution, where ord(H) ≤ 2k , then:

Theorem [Pak,Bratus,'99]

Sampling k + 4 elements yields a generating set for H withprobability ≥ 3

4.

But in general we can have arbitrary distributions!

14

Arbitrary distribution

Much more di�cult.

Idea: we restrict to a large enough subgroup. Details are tricky

Theorem

If H < G is a sampleable subgroup according to arbitrarydistribution D, with ord(H) ≤ 2k , then: sampling7k · (2+ dlog(k)e) + 1 elements yields a generating set for H withprobability ≈ 3

4, regardless of D.

15

Arbitrary distribution

Much more di�cult.

Idea: we restrict to a large enough subgroup.

Details are tricky

Theorem

If H < G is a sampleable subgroup according to arbitrarydistribution D, with ord(H) ≤ 2k , then: sampling7k · (2+ dlog(k)e) + 1 elements yields a generating set for H withprobability ≈ 3

4, regardless of D.

15

Arbitrary distribution

Much more di�cult.

Idea: we restrict to a large enough subgroup. Details are tricky

Theorem

If H < G is a sampleable subgroup according to arbitrarydistribution D, with ord(H) ≤ 2k , then: sampling7k · (2+ dlog(k)e) + 1 elements yields a generating set for H withprobability ≈ 3

4, regardless of D.

15

Arbitrary distribution

Much more di�cult.

Idea: we restrict to a large enough subgroup. Details are tricky

Theorem

If H < G is a sampleable subgroup according to arbitrarydistribution D, with ord(H) ≤ 2k , then: sampling7k · (2+ dlog(k)e) + 1 elements yields a generating set for H withprobability ≈ 3

4, regardless of D.

15

The attack

1 generate a large enough number of encryptions of the neutralelement 1G , obtaining c1, . . . , cn

2 run Watrous' algorithm on {c1, . . . , cn}, obtaining order o1

3 play the IND-CPA game by choosing m0 = 1G and m1 6= 1G ;receive challenge ciphertext c

4 run Watrous' algorithm on {c1, . . . , cn, c}, obtaining order o2

5 if o1 = o2 then output 0, else output 1

Theorem

No GHE scheme can be IND-CPA secure against quantumadversaries.

16

The attack

1 generate a large enough number of encryptions of the neutralelement 1G , obtaining c1, . . . , cn

2 run Watrous' algorithm on {c1, . . . , cn}, obtaining order o1

3 play the IND-CPA game by choosing m0 = 1G and m1 6= 1G ;receive challenge ciphertext c

4 run Watrous' algorithm on {c1, . . . , cn, c}, obtaining order o2

5 if o1 = o2 then output 0, else output 1

Theorem

No GHE scheme can be IND-CPA secure against quantumadversaries.

16

The attack

1 generate a large enough number of encryptions of the neutralelement 1G , obtaining c1, . . . , cn

2 run Watrous' algorithm on {c1, . . . , cn}, obtaining order o1

3 play the IND-CPA game by choosing m0 = 1G and m1 6= 1G ;receive challenge ciphertext c

4 run Watrous' algorithm on {c1, . . . , cn, c}, obtaining order o2

5 if o1 = o2 then output 0, else output 1

Theorem

No GHE scheme can be IND-CPA secure against quantumadversaries.

16

The attack

1 generate a large enough number of encryptions of the neutralelement 1G , obtaining c1, . . . , cn

2 run Watrous' algorithm on {c1, . . . , cn}, obtaining order o1

3 play the IND-CPA game by choosing m0 = 1G and m1 6= 1G ;receive challenge ciphertext c

4 run Watrous' algorithm on {c1, . . . , cn, c}, obtaining order o2

5 if o1 = o2 then output 0, else output 1

Theorem

No GHE scheme can be IND-CPA secure against quantumadversaries.

16

The attack

1 generate a large enough number of encryptions of the neutralelement 1G , obtaining c1, . . . , cn

2 run Watrous' algorithm on {c1, . . . , cn}, obtaining order o1

3 play the IND-CPA game by choosing m0 = 1G and m1 6= 1G ;receive challenge ciphertext c

4 run Watrous' algorithm on {c1, . . . , cn, c}, obtaining order o2

5 if o1 = o2 then output 0, else output 1

Theorem

No GHE scheme can be IND-CPA secure against quantumadversaries.

16

The attack

1 generate a large enough number of encryptions of the neutralelement 1G , obtaining c1, . . . , cn

2 run Watrous' algorithm on {c1, . . . , cn}, obtaining order o1

3 play the IND-CPA game by choosing m0 = 1G and m1 6= 1G ;receive challenge ciphertext c

4 run Watrous' algorithm on {c1, . . . , cn, c}, obtaining order o2

5 if o1 = o2 then output 0, else output 1

Theorem

No GHE scheme can be IND-CPA secure against quantumadversaries.

16

In the FHE case...

Our attack strictly relies on the group structure.

Su�cient condition: there exist two plaintexts, m0 6= m1, and asubgroup H such that:• we have a PPT algorithm which outputs a small set ofgenerators for H

• the probability that Enc(m0) lies in H is high• the probability that Enc(m1) lies in G \ H is high

17

In the FHE case...

Our attack strictly relies on the group structure.

Su�cient condition: there exist two plaintexts, m0 6= m1, and asubgroup H such that:

• we have a PPT algorithm which outputs a small set ofgenerators for H

• the probability that Enc(m0) lies in H is high• the probability that Enc(m1) lies in G \ H is high

17

In the FHE case...

Our attack strictly relies on the group structure.

Su�cient condition: there exist two plaintexts, m0 6= m1, and asubgroup H such that:• we have a PPT algorithm which outputs a small set ofgenerators for H

• the probability that Enc(m0) lies in H is high• the probability that Enc(m1) lies in G \ H is high

17

In the FHE case...

Our attack strictly relies on the group structure.

Su�cient condition: there exist two plaintexts, m0 6= m1, and asubgroup H such that:• we have a PPT algorithm which outputs a small set ofgenerators for H

• the probability that Enc(m0) lies in H is high

• the probability that Enc(m1) lies in G \ H is high

17

In the FHE case...

Our attack strictly relies on the group structure.

Su�cient condition: there exist two plaintexts, m0 6= m1, and asubgroup H such that:• we have a PPT algorithm which outputs a small set ofgenerators for H

• the probability that Enc(m0) lies in H is high• the probability that Enc(m1) lies in G \ H is high

17

In the FHE case...

Our attack strictly relies on the group structure.

Su�cient condition: there exist two plaintexts, m0 6= m1, and asubgroup H such that:• we have a PPT algorithm which outputs a small set ofgenerators for H

• the probability that Enc(m0) lies in H is high• the probability that Enc(m1) lies in G \ H is high

17

End of this talk (for good...)

Thanks for your attention!

tommaso@gagliardoni.net

18